Malicious code in karapace-docs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a0d1e2b10c31f45e3c73ad895a1ccd4188cdedf5ab1a795b420f5aa2693d7686 The npm package's preinstall hook runs index.js at install time, which collects the installer's hostname, username, home directory, DNS server list,...

MAL-2026-12794 Malicious code in karapace-docs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a0d1e2b10c31f45e3c73ad895a1ccd4188cdedf5ab1a795b420f5aa2693d7686 The npm package's preinstall hook runs index.js at install time, which collects the installer's hostname, username, home directory, DNS server list,...

Malicious code in poly-bbc-service (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3bb49d43833628610acae14ea039bb3a490dc94ec90bd8faac084a977a8f8ebd The package's exported getPlugin function issues an HTTPS request to the hardcoded bare-IP endpoint https://46.183.25.232:45000/icons/107 and passes...

MAL-2026-12799 Malicious code in poly-bbc-service (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3bb49d43833628610acae14ea039bb3a490dc94ec90bd8faac084a977a8f8ebd The package's exported getPlugin function issues an HTTPS request to the hardcoded bare-IP endpoint https://46.183.25.232:45000/icons/107 and passes...

Malicious code in streak-grid-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b40df62bf7b6dcc3bc33d5b2b876ea57e4f355dd326f48ec7a6d3750fa6148d7 The package advertises itself as dependency-free calendar/streak math primitives, but the main entry index.mjs, resolved via package.json exports "."...

MAL-2026-12807 Malicious code in streak-grid-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b40df62bf7b6dcc3bc33d5b2b876ea57e4f355dd326f48ec7a6d3750fa6148d7 The package advertises itself as dependency-free calendar/streak math primitives, but the main entry index.mjs, resolved via package.json exports "."...

Malicious code in @cryptosrvc/shift-exchange-root (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5ff6c468a083fe963c94caf5edbd3b36e83ba753c9c2d14c807f6a4bb3b6048a On npm install, the package runs dist/recon.js as a postinstall script that collects the installer's hostname, username, SUDOUSER, home directory,...

Malicious code in node-cache-multithread (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 09be7b43b4fe5e0c786fb116e4a99518c46825e2b18b5e65eca88c51470b07a0 index.js, the package's declared main entry, is a 23KB obfuscator.io RC4/base64 string-array bundle whose top-level IIFE runs on require. It requires...

MAL-2026-12403 Malicious code in node-cache-multithread (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 09be7b43b4fe5e0c786fb116e4a99518c46825e2b18b5e65eca88c51470b07a0 index.js, the package's declared main entry, is a 23KB obfuscator.io RC4/base64 string-array bundle whose top-level IIFE runs on require. It requires...

MAL-2026-12378 Malicious code in express-rate-controller (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 43c2ed4e91378e1ca9df444de58c0ff3afebce39741ab67011b55490740cac11 The package is published under the name express-rate-controller but describes itself as an SVG utilities library and ships a bin named svgcraft — the...

Malicious code in rollup-plugins-check (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5f2c7fe6586c3734730d6f8cd5ffe893c3f7cc5ff82710d1f4df22b8e76987e8 The npm package [email protected] declares a postinstall script node dist/module.js that, on npm install, performs an HTTPS GET to...

Malicious code in poly-custom-api (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a3263a9e2a986068fafa530a8e6862f9ba41cad05ecbd5b7b91752ca1c5af0c6 The default export getPlugin in index.js constructs an HTTPS URL from split constants pointing at the bare IP 46.183.25.232:45000/icons/108, fetches...

MAL-2026-12416 Malicious code in poly-custom-api (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a3263a9e2a986068fafa530a8e6862f9ba41cad05ecbd5b7b91752ca1c5af0c6 The default export getPlugin in index.js constructs an HTTPS URL from split constants pointing at the bare IP 46.183.25.232:45000/icons/108, fetches...

Malicious code in akamaijs-sensor (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 14a4955c82b04226b267bc55691b0b9c08770710a7038b58e75bfdd009d046fe The package presents itself as an Akamai sensor generator but ships two coupled malicious mechanisms. index.js contains a / / comment filled with...

MAL-2026-12471 Malicious code in streak-view-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ba1dc8ef2cb065b1f88428f0530efa28647e4f8202f493a5646f06c47d3235dd index.mjs contains an indexCache array of base64 string chunks whose decoded bytes begin with the ELF magic and reference /lib64/ld-linux-x86-64.so.2...

Malicious code in streak-view-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ba1dc8ef2cb065b1f88428f0530efa28647e4f8202f493a5646f06c47d3235dd index.mjs contains an indexCache array of base64 string chunks whose decoded bytes begin with the ELF magic and reference /lib64/ld-linux-x86-64.so.2...

MAL-2026-12348 Malicious code in chai-as-rendered (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 545ba2341881e666831e81156a815fdfac738830ec2918167e4c5fd3c42294bf Typosquat of chai-as-promised. The package's exported middleware spawns a detached child process lib/caller.js that fetches a JSON payload from a...

Malicious code in express-middle (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 91c0275a4e65fc4ed9930cb89002f2c4ebc50163b292f552703c4ea6a9940567 package.json declares postinstall: node index.js, which fires automatically on npm install. index.js is a heavily obfuscated bundle obfuscator.io-sty...

MAL-2026-12349 Malicious code in chai-assertions-plus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 80a83cd9353779d12538e8c6b06276178f6f0c246abd7d5148ce805536cbf57f The package is published as a Chai assertions extension, but the shipped code in index.js and lib/ is unrelated Pino logger source used as filler...

Malicious code in wallet-analytics (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bfc85c0238f90672b0cc329cae3487061924ed5a6458644a97cd90a830ace807 index.js exports a getPlugin function that issues an HTTPS request to a hardcoded bare-IP endpoint at https://46.183.25.232:45000/icons/ and passes t...